Most recent entries from all

4HZM000604 — ABB Ability Camera Connect Vulnerabilities in outdated 3rd party component (SQLite 3.2.4)

ABB is aware of public reports of vulnerabilities in a 3rd party dependency SQLite Version 3.2.4 which was delivered together with the installation package of Camera Connect Version 2.0.0.42 and below. An update is available that resolves a privately reported outdated 3rd party component with vulnerabilities in the product versions listed as affected in the advisory.

An attacker who successfully exploited any of these vulnerabilities in the 3rd party component could potentially compromise the system in different ways.

ALSA-2021:1968 — Moderate: mingw packages security and bug fix update

Affected: AlmaLinux:8: mingw-binutils-generic, AlmaLinux:8: mingw-filesystem-base, AlmaLinux:8: mingw32-binutils, AlmaLinux:8: mingw32-bzip2, AlmaLinux:8: mingw32-bzip2-static, AlmaLinux:8: mingw32-filesystem, AlmaLinux:8: mingw32-sqlite, AlmaLinux:8: mingw32-sqlite-static, AlmaLinux:8: mingw64-binutils, AlmaLinux:8: mingw64-bzip2 and 4 more

MinGW is a free and open source software development environment to create Microsoft Windows applications.

The following packages have been upgraded to a later upstream version: mingw-sqlite (3.26.0.0). (BZ#1845475)

Security Fix(es):

* sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

* sqlite: Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)

* sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

* sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

* sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query (CVE-2020-13632)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-05062

Withdrawn: BELL-CVE-2020-13434 — CVE-2020-13434 does not affect BellSoft software

Withdrawn by the publisher.

BIT-sqlite-2020-13434

Affected: Bitnami: sqlite

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

certfr-2020-avi-747 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2020-avi-747

CLEANSTART-2026-SF72367 — Security fix for CVE-2020-13434 applied in: sqlite 3.32.1-r0

Affected: CleanStart: sqlite

Security vulnerability affects the sqlite package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2020-31671

EUVD-2026-41784

fkie_cve-2020-13434

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

GHSA-fjp7-rxx4-gq9h

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

gsd-2020-13434

ICSA-23-348-10 — Siemens SIMATIC S7-1500

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

msrc_CVE-2020-13434 — SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

msrc_CVE-2020-13434

openSUSE-SU-2021:1058-1 — Security update for sqlite3

Security update for sqlite3

RHSA-2025:16504 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19 security, enhancement & bug fix update

sqlite: infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements sqlite: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns sqlite: malformed window-function query leads to DoS sqlite: use-after-free in the ALTER TABLE implementation sqlite: integer overflow in sqlite3_str_vappendf function in printf.c sqlite: NULL pointer dereference in sqlite3ExprCodeTarget() sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c sqlite: Virtual table can be renamed into the name of one of its shadow tables sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query

SUSE-SU-2021:2320-1 — Security update for sqlite3

Security update for sqlite3

UBUNTU-CVE-2020-13434

Affected: Ubuntu:16.04:LTS: sqlite3, Ubuntu:18.04:LTS: sqlite3, Ubuntu:20.04:LTS: sqlite3

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

WID-SEC-W-2023-0856 — IBM QRadar SIEM: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.